Why a Locked Exit Door Is the Oldest Fatal Mistake

Why this matters

Nobody locks an exit door out of malice. They lock it because something real is happening on the other side: theft, loitering, drug activity in the alley, staff propping it for smoke breaks, an unsecured yard. The lock solves that problem completely and creates a different one that stays invisible for years. The reason this failure keeps repeating is that "locked" and "unlocked" is the wrong frame. The right frame is a single gate that every exit door either passes or does not, and a short, closed list of named arrangements that are allowed to fail that gate on purpose. This card gives you the gate, then runs it against two doors in the same building that come out opposite ways.

The gate

Can a person leaving, with no key, no tool, no special knowledge, and no prior instruction about this door, get through it with one motion of the hand in the direction of travel?

Every word in that sentence is load-bearing.

• No key, no tool, no special knowledge is the federal floor almost verbatim. 29 CFR 1910.36(d) requires that employees be able to open an exit route door from the inside at all times without keys, tools, or special knowledge, and the limited exception at 1910.36(d) covers mental, penal, and correctional facilities where employees are supervised. That standard runs to your employees; the adopted building and fire codes run to the building and reach everyone in it, which is why you cite both and say which one you are quoting.
• One motion is the adopted-code half. NFPA 101, in the edition your authority having jurisdiction has adopted and amended, permits not more than one releasing operation on a door in a means of egress, with a small set of exceptions in that edition. The authority having jurisdiction is a named role with authority to interpret and enforce the adopted code, not a synonym for whoever inspects.
• In the direction of travel matters because a door that releases fine when you have time to think about it is a different device from a door with fifteen people pressed against it.
• No prior instruction is the one people argue with. "Everyone here knows about the thumbturn" is an argument about a normal day. The door only matters on the other kind.

Force belongs to the same gate. NFPA 101 in the adopted edition caps the force to release the latch, the force to set the door in motion, and the force to swing it to full open, with the middle number commonly stated as not more than 30 lbf to set a side-hinged swinging door in motion. Those caps are why a stair pressurization system cannot simply be turned up; the stair pressurization card owns that interaction.

Failing the gate is not automatically a violation

This is the part that gets lost. The adopted code names a small number of arrangements that deliberately fail the one-motion test, and each one is permitted only with a full set of conditions attached. The arrangement is not a judgment call you get to make; it is a listed assembly installed under a named allowance, and if any one of its conditions is missing, you do not have the arrangement, you have a locked exit door.

• Delayed egress. A listed device holds the door for a stated delay, commonly 15 seconds, extendable in the adopted edition where the AHJ approves. Applying force for a few seconds starts an irreversible release, a local alarm sounds, a sign is posted at the door, and the lock releases immediately on fire alarm actuation, on sprinkler system waterflow, and on loss of power.
• Access-controlled egress doors. A sensor on the egress side unlocks the door on approach, a clearly identified manual release is mounted on the egress side within a stated height range, a sign is posted, and the lock fails unlocked on loss of power and on alarm.
• Occupancy-specific clinical or security locking, in health care and detention occupancies, under the adopted chapter for that occupancy, with staff on duty who carry keys and a written plan.

The conditions are the arrangement. A delayed-egress device with no sign, or with the release wired to only some of its required initiating inputs, is not a compliant delayed-egress door and it will not behave like one.

The hardware that never passes

Some things are not close calls, and they are the ones a field crew installs.

• A keyed deadbolt above a panic device. That is a second operation and it needs a key.
• A slide bolt, barrel bolt, hasp, or padlock on the egress side.
• A chain and padlock, in any configuration, including "only after hours" on a building that has occupants after hours.
• A security bar dropped into floor sockets.
• A magnetic lock with no listed release on the egress side, or one whose release path depends on a card reader, a request-to-exit motion sensor alone, or an access control server staying up.

Two more that are less obvious. Where the adopted code requires listed panic hardware based on occupant load or contents, a lever set alone fails even though it releases in one motion. And rooms are doors too: NFPA 70, as adopted by your state or local jurisdiction, requires listed panic hardware on personnel doors serving certain large electrical equipment rooms, which is a requirement an electrical crew owns and a locksmith usually does not know about.

One gate, two doors, opposite answers

Same building, same afternoon, same technician.

Door A: the retail suite's rear exit. It carries a listed panic device, and above the device the tenant has added a keyed deadbolt and, at the top of the leaf, a slide bolt. The reason is honest: three break-ins in a year, all through this door from the alley.

Run the gate. A person leaving needs three separate motions, one of which needs a key that lives in the manager's desk. It fails on operations, fails on key, fails on prior knowledge. Is it a named arrangement? No, because nothing on this door is a listed egress-locking assembly under any allowance in the adopted code. The answer is not "get approval," it is "this cannot exist."

The compliant fix has to solve the tenant's actual problem, which is entry from the alley, not exit to it. The deadbolt and slide bolt come off. The panic device is replaced with an alarmed exit device so an unauthorized exit is announced, and the outside face gets a keyed exterior trim and, if the tenant wants it, a credentialed reader. Nothing on the egress side changes. Removing hardware and patching two leaf penetrations plus setting the alarmed device ran about 4 shop hours against the roughly 3 hours the tenant's own hardware had taken. The compliant version cost about a third more time and solved the break-ins, which the deadbolt only solved at night.

Door B: the corridor door into the behavioral health suite upstairs. It carries a listed delayed-egress device with a 15-second delay, a sign at the door, and a local sounder. It fails the one-motion gate by design.

That is allowed, so now the work is verifying every condition rather than judging the door. Sign present and legible: yes. Local alarm on initiation: verified by applying force, the sounder ran, the door released at the end of the delay and had to be reset. Release on loss of power: verified by opening the branch circuit feeding the lock power supply. Before touching that circuit the technician opened and locked the breaker, then proved the supply dead with a meter checked live-dead-live per NFPA 70E-2021, 120.5, under 29 CFR 1910.333(b)(2) for work on an electric circuit; the door released as required. Release on fire alarm actuation: verified with the fire alarm panel placed on test with the monitoring station notified in advance and the AHJ notified per the adopted NFPA 72 edition, then restored off test the same visit.

Release on sprinkler waterflow: not verified, because the waterflow switch was never mapped to the lock release. The alarm panel's programming shows the waterflow input annunciating and initiating notification, with no output to the door release relay.

So Door B, which looked compliant, resolves the same way Door A did. One of its required conditions is absent, so the arrangement is not the arrangement. The difference is that Door A was visible from the parking lot and Door B needed a panel test and a print to find. That is why a delayed-egress door belongs on a tested-and-recorded list rather than on a walk-around list.

Correction, printed. Door A: three releasing operations reduced to one, key requirement removed, and the security function moved from the egress side to the exterior side. Door B: one of the required release initiators found missing, so the door is a locked exit until the waterflow input is programmed to the release relay and re-tested; the interim measure is the door held unlocked with the delay device disabled, with staff posted at the door as the named compensating measure for as long as it is unlocked, both the state and the compensating measure notified to the AHJ and to the clinical manager in writing that day and carried with a start time and a named end.

Sibling-rule check. Nothing in either resolution introduces a lockable space in an exit access path, which the egress-path card prohibits. Neither door is inside an exit enclosure, so no penetration or storage rule from that card is engaged. Door B's interim unlocked state is written as a dated, bounded condition with a named end, which the fire protection records card requires of any managed out-of-service state. The alarm panel was placed on test and taken off test the same visit, and both times are recorded, so no impairment ran past the visit without a note.

Verifying it on your own jobs

Do the walk from the inside, in the dark, with one hand, wearing a glove. That single test catches thumbturns, second operations, high-mounted bolts, and hardware that needs two hands. Then do the paperwork half: for every door in the building that fails the one-motion gate on purpose, name the allowance it is permitted under, list that allowance's conditions, and mark each condition tested or not tested with a date. A delayed-egress door with an untested release path is indistinguishable, on the worst day, from a chained door.

The failure mode to watch for is not the obvious padlock. It is the compliant assembly that quietly stopped being compliant: a lock power supply moved to a circuit that no longer drops on alarm, an access control system replaced by a different platform whose fail-safe behavior nobody re-tested, a sign painted over. Every one of those is created by ordinary work by people who were not thinking about egress at all.

References

• 29 CFR 1910.36(d), exit route doors must be openable from the inside without keys, tools, or special knowledge in general industry; 29 CFR 1926 Subpart F for construction work
• NFPA 101 Life Safety Code, in the edition adopted and amended by your authority having jurisdiction, for releasing-operation limits, door-opening force limits, and the named egress-locking allowances
• NFPA 72 National Fire Alarm and Signaling Code, in the adopted edition, for placing a system on test and for notification before and after
• NFPA 70E-2021, 120.5 for the live-dead-live proving sequence, applied under 29 CFR 1910.333(b)(2) for electrical work
• See related: What a Means of Egress Cannot Pass Through; Why a Stair Pressurization System Fails Quietly